#33162 [NEW]: imagecreatefromstring segfaults

From: julien at synten dot com Operating system: Linux 2.4.29 PHP version: 4.3.11 PHP Bug Type: Reproducible crash Bug description: imagecreatefromstring segfaults Description: ------------ imagecreatefromstring seems to segfault when a a bogus string with letters is provided, works when this string is only non-char. Reproduce code: --------------- 27/05 12:15 root@meteor /home/julien/www# php <?php $test = str_repeat("/", 10); $gd1 = imagecreatefromstring($test); echo "OK 10\n"; ?> Warning: imagecreatefromstring() [http://www.php.net/function.imagecreatefromstring]: Data is not in a recognized format. in - on line 3 OK 10 27/05 12:15 root@meteor /home/julien/www# php <?php $test = str_repeat("bad", 5); $gd1 = imagecreatefromstring($test); echo "Normal is OK \n"; ?> zsh: segmentation fault php 27/05 12:15 root@meteor /home/julien/www# php <?php $test = str_repeat("/", 10); $gd1 = imagecreatefromstring($test); echo "OK 10\n"; ?> Warning: imagecreatefromstring() [http://www.php.net/function.imagecreatefromstring]: Data is not in a recognized format. in - on line 3 OK 10 27/05 12:15 root@meteor /home/julien/www# php <?php $test = str_repeat("a", 10); $gd1 = imagecreatefromstring($test); echo "OK 10\n"; ?> zsh: segmentation fault php 27/05 12:15 root@meteor /home/julien/www# php <?php $test = str_repeat("*", 10); $gd1 = imagecreatefromstring($test); echo "OK 10\n"; ?> Warning: imagecreatefromstring() [http://www.php.net/function.imagecreatefromstring]: Data is not in a recognized format. in - on line 3 OK 10 27/05 12:16 root@meteor /home/julien/www# php <?php $test = str_repeat("q", 10); $gd1 = imagecreatefromstring($test); echo "OK 10\n"; ?> zsh: segmentation fault php Expected result: ---------------- No segfaults, just warnings. Actual result: -------------- Segfaults. -- Edit bug report at http://bugs.php.net/?id=33162&edit=1 -- Try a CVS snapshot (php4): http://bugs.php.net/fix.php?id=33162&r=trysnapshot4 Try a CVS snapshot (php5.0): http://bugs.php.net/fix.php?id=33162&r=trysnapshot50 Try a CVS snapshot (php5.1): http://bugs.php.net/fix.php?id=33162&r=trysnapshot51 Fixed in CVS: http://bugs.php.net/fix.php?id=33162&r=fixedcvs Fixed in release: http://bugs.php.net/fix.php?id=33162&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=33162&r=needtrace Need Reproduce Script: http://bugs.php.net/fix.php?id=33162&r=needscript Try newer version: http://bugs.php.net/fix.php?id=33162&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=33162&r=support Expected behavior: http://bugs.php.net/fix.php?id=33162&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=33162&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=33162&r=submittedtwice register_globals: http://bugs.php.net/fix.php?id=33162&r=globals PHP 3 support discontinued: http://bugs.php.net/fix.php?id=33162&r=php3 Daylight Savings: http://bugs.php.net/fix.php?id=33162&r=dst IIS Stability: http://bugs.php.net/fix.php?id=33162&r=isapi Install GNU Sed: http://bugs.php.net/fix.php?id=33162&r=gnused Floating point limitations: http://bugs.php.net/fix.php?id=33162&r=float No Zend Extensions: http://bugs.php.net/fix.php?id=33162&r=nozend MySQL Configuration Error: http://bugs.php.net/fix.php?id=33162&r=mysqlcfg